@taskforcehq/taskforce 0.3.327 → 0.3.329

package/dist/server/cloudCollectionReadPool.js

@@ -0,0 +1,140 @@
+import { Worker } from 'node:worker_threads';
+const DEFAULT_POOL_SIZE = 2;
+const MAX_POOL_SIZE = 8;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+function positiveInteger(value, fallback) {
+    if (!Number.isFinite(value) || Number(value) <= 0)
+        return fallback;
+    return Math.max(1, Math.floor(Number(value)));
+}
+export class CloudCollectionReadPool {
+    slots = [];
+    queue = [];
+    requestTimeoutMs;
+    desiredSize;
+    workerData;
+    workerFactory;
+    nextRequestId = 1;
+    closing = false;
+    constructor(options) {
+        this.requestTimeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS);
+        this.workerData = {
+            projectRoot: options.projectRoot,
+            tenantId: options.tenantId,
+            connectionString: options.connectionString,
+        };
+        this.workerFactory = options.workerFactory || (() => new Worker(new URL('./cloudCollectionReadWorker.js', import.meta.url), { workerData: this.workerData }));
+        this.desiredSize = Math.min(MAX_POOL_SIZE, positiveInteger(options.size, DEFAULT_POOL_SIZE));
+    }
+    execute(request) {
+        if (this.closing) {
+            return Promise.reject(new Error('[Taskforce] Cloud collection read pool is closed.'));
+        }
+        this.ensureSlots();
+        return new Promise((resolve, reject) => {
+            this.queue.push({ request, resolve, reject });
+            this.pump();
+        });
+    }
+    async close() {
+        if (this.closing)
+            return;
+        this.closing = true;
+        const closedError = new Error('[Taskforce] Cloud collection read pool closed before the request completed.');
+        for (const pending of this.queue.splice(0))
+            pending.reject(closedError);
+        await Promise.all(this.slots.splice(0).map(async (slot) => {
+            if (slot.active) {
+                clearTimeout(slot.active.timeout);
+                slot.active.reject(closedError);
+                slot.active = null;
+            }
+            slot.worker.postMessage({ type: 'close' });
+            await slot.worker.terminate();
+        }));
+    }
+    spawnSlot() {
+        if (this.closing)
+            return;
+        const worker = this.workerFactory();
+        const slot = { worker, ready: false, active: null };
+        this.slots.push(slot);
+        worker.on('message', (message) => this.handleMessage(slot, message));
+        worker.on('error', (error) => this.handleWorkerFailure(slot, error instanceof Error ? error : new Error(String(error))));
+        worker.on('exit', (code) => {
+            if (!this.closing && this.slots.includes(slot)) {
+                this.handleWorkerFailure(slot, new Error(`[Taskforce] Cloud collection read worker exited with code ${code}.`));
+            }
+        });
+    }
+    handleMessage(slot, message) {
+        if (message.type === 'ready') {
+            slot.ready = true;
+            this.ensureSlots();
+            this.pump();
+            return;
+        }
+        const active = slot.active;
+        if (!active || active.requestId !== message.requestId)
+            return;
+        clearTimeout(active.timeout);
+        slot.active = null;
+        if (message.type === 'result')
+            active.resolve(message.response);
+        else
+            active.reject(new Error(message.error || '[Taskforce] Cloud collection read worker failed.'));
+        this.pump();
+    }
+    handleWorkerFailure(slot, error) {
+        const slotIndex = this.slots.indexOf(slot);
+        if (slotIndex < 0)
+            return;
+        this.slots.splice(slotIndex, 1);
+        if (slot.active) {
+            clearTimeout(slot.active.timeout);
+            slot.active.reject(error);
+            slot.active = null;
+        }
+        void slot.worker.terminate();
+        if (!this.closing && this.slots.length === 0) {
+            for (const pending of this.queue.splice(0))
+                pending.reject(error);
+        }
+        this.pump();
+    }
+    ensureSlots() {
+        if (this.closing)
+            return;
+        if (this.slots.some((slot) => !slot.ready))
+            return;
+        if (this.slots.length < this.desiredSize)
+            this.spawnSlot();
+    }
+    pump() {
+        if (this.closing || this.queue.length === 0)
+            return;
+        for (const slot of this.slots) {
+            if (!slot.ready || slot.active || this.queue.length === 0)
+                continue;
+            const pending = this.queue.shift();
+            const requestId = this.nextRequestId++;
+            const timeout = setTimeout(() => {
+                this.handleWorkerFailure(slot, new Error(`[Taskforce] Cloud collection read worker timed out after ${this.requestTimeoutMs}ms.`));
+            }, this.requestTimeoutMs);
+            timeout.unref?.();
+            slot.active = { ...pending, requestId, timeout };
+            slot.worker.postMessage({ type: 'execute', requestId, request: pending.request });
+        }
+    }
+}
+export function resolveCloudCollectionReadPoolSize(env = process.env) {
+    if (String(env.TASKFORCE_CLOUD_READ_WORKERS || '').trim() === '0')
+        return 0;
+    return Math.min(MAX_POOL_SIZE, positiveInteger(Number(env.TASKFORCE_CLOUD_READ_WORKERS), DEFAULT_POOL_SIZE));
+}
+export function shouldUseCloudCollectionReadPool(input) {
+    return input.runtimeMode === 'cloud'
+        && input.databaseProvider === 'postgres'
+        && Boolean(String(input.connectionString || '').trim())
+        && input.workerCount > 0;
+}

package/dist/server/cloudCollectionReadWorker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/cloudCollectionReadWorker.js

@@ -0,0 +1,36 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import { TaskforceCore } from '../core/Taskforce.js';
+import { executeCloudCollectionRead, } from './cloudCollectionRead.js';
+if (!parentPort) {
+    throw new Error('[Taskforce] Cloud collection read worker requires a parent port.');
+}
+const config = workerData;
+const core = new TaskforceCore({
+    projectRoot: config.projectRoot,
+    tenantId: config.tenantId,
+    runtimeMode: 'cloud',
+    initializationMode: 'cloud-read-worker',
+    database: {
+        provider: 'postgres',
+        connectionString: config.connectionString,
+    },
+});
+parentPort.on('message', (message) => {
+    if (message.type === 'close') {
+        core.close();
+        parentPort?.close();
+        return;
+    }
+    try {
+        const response = executeCloudCollectionRead(core, message.request);
+        parentPort?.postMessage({ type: 'result', requestId: message.requestId, response });
+    }
+    catch (error) {
+        parentPort?.postMessage({
+            type: 'error',
+            requestId: message.requestId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+});
+parentPort.postMessage({ type: 'ready' });

package/dist/server/index.d.ts

@@ -6,8 +6,9 @@
  */
 import * as http from 'http';
 import { WebSocketServer } from 'ws';
-import { TaskforceCore } from '../core/Taskforce.js';
-import type { RequestAccessContext } from './auth.js';
+export { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, isWorkspaceAccessRecoveryRoute, } from './authorizedWorkspaceAccess.js';
+import type { LocalServiceCloudTarget } from '../config/localServiceCloudTarget.js';
+import type { LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
 import type { LocalSyncCoordinatorHost } from '../sync/coordinator/localSyncCoordinatorHost.js';
 import type { LocalSyncProcessLock } from '../sync/coordinator/localSyncProcessLock.js';
 import type { LocalDataOwnerPermit } from './localDataOwnerPermit.js';
@@ -25,6 +26,8 @@ export interface StandaloneServerOptions {
         ownerPid: number;
         bootstrapCapability: string;
         ownershipKey: string;
+        cloudTarget: LocalServiceCloudTarget;
+        runtimeContract: LocalServiceRuntimeContract;
     };
 }
 export interface TaskforceStandaloneServer extends http.Server {
@@ -45,17 +48,10 @@ export declare const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = "x-taskforce-origin-p
 export declare const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = "x-taskforce-origin-base-url";
 export declare const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = "x-taskforce-origin-runtime";
 export declare const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = "x-taskforce-cloud-environment";
-interface AuthorizedRequestAccess extends RequestAccessContext {
-    disabled?: boolean;
-    accountDisabled?: boolean;
-    workspaceDisabled?: boolean;
-}
-export declare function isWorkspaceAccessRecoveryRoute(pathname: string): boolean;
-export declare function resolveDisabledAccessError(access: Pick<AuthorizedRequestAccess, 'disabled' | 'accountDisabled' | 'workspaceDisabled'>, pathname: string): string | null;
+export declare function sanitizeQaRunIdHeader(raw: unknown): string;
 export declare function shouldProxyCloudPath(pathname: string): boolean;
 export declare function shouldProxyCloudRequest(url: Pick<URL, 'pathname' | 'searchParams'>, env?: NodeJS.ProcessEnv): boolean;
 export declare function resolveCloudProxyUpstreamBaseUrl(req: http.IncomingMessage, fallbackBaseUrl: string): string;
-export declare function resolveAuthorizedWorkspaceAccess(core: Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
 export declare function shouldApplyReadOnlyMutationGuard(methodRaw: string | undefined, pathname: string): boolean;
 export declare function resolveEffectiveRequestUserId(accessUserId: string, explicitUserId: string): string;
 export declare function resolveMaxPayloadBytesForPath(pathname: string, defaultMaxBytes: number): number;
@@ -72,4 +68,3 @@ export declare function ensurePublicPricingAuthExclusion(excludedPaths: string[]
 export declare function ensurePublicSiteConfigAuthExclusion(excludedPaths: string[]): string[];
 export declare function isBillingWebhookPath(pathname: string): boolean;
 export declare function createStandaloneServer(options: StandaloneServerOptions): TaskforceStandaloneServer;
-export {};

package/dist/server/index.js

@@ -14,9 +14,12 @@ import chokidar from 'chokidar';
 import { TaskforceCore } from '../core/Taskforce.js';
 import { createRoutes, matchRoute } from './routes.js';
 import { formatApiErrorResponse } from './routes/primitives.js';
+import { logSlowBootstrapRoute } from './routes/shared.js';
 import { applyCorsHeaders, getAllowedOriginsFromEnv } from './cors.js';
-import { applyPrefixedRateLimitHeaders, applyRateLimitHeaders, InMemoryRateLimiter, resolveRateLimitKey } from './rateLimit.js';
+import { applyPrefixedRateLimitHeaders, applyRateLimitHeaders, InMemoryRateLimiter, isWorkspaceSyncFeedRead, resolveRateLimitKey, } from './rateLimit.js';
 import { isRequestAuthorized, resolveAuthConfigFromEnv, resolveRequestAccess } from './auth.js';
+import { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, } from './authorizedWorkspaceAccess.js';
+export { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, isWorkspaceAccessRecoveryRoute, } from './authorizedWorkspaceAccess.js';
 import { assertCloudDatabaseProvider, resolveRuntimeModeFromEnv } from './runtimeMode.js';
 import { applySecurityHeaders } from './securityHeaders.js';
 import { resolveDatabaseConfigFromEnv } from '../storage/providerConfig.js';
@@ -37,6 +40,8 @@ import { createWorkspaceSyncServerComposition, shutdownWorkspaceSyncServerCompos
 import { LocalServiceSessionManager } from './localServiceSessions.js';
 import { LocalSyncIdentityStore } from '../sync/v3/localSyncIdentityStore.js';
 import { shouldBroadcastLocalFileInvalidation } from './localRealtimeFileInvalidation.js';
+import { resolveCloudCollectionReadOperation, } from './cloudCollectionRead.js';
+import { CloudCollectionReadPool, resolveCloudCollectionReadPoolSize, shouldUseCloudCollectionReadPool, } from './cloudCollectionReadPool.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const MIME_TYPES = {
@@ -173,20 +178,11 @@ export const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = 'x-taskforce-origin-proto';
 export const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = 'x-taskforce-origin-base-url';
 export const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = 'x-taskforce-origin-runtime';
 export const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = 'x-taskforce-cloud-environment';
-export function isWorkspaceAccessRecoveryRoute(pathname) {
-    return pathname === '/api/taskforce/workspaces'
-        || pathname === '/api/taskforce/session/workspace';
-}
-export function resolveDisabledAccessError(access, pathname) {
-    if (pathname.startsWith('/api/taskforce/auth/'))
-        return null;
-    if (access.accountDisabled ?? access.disabled) {
-        return 'Forbidden: user account is disabled.';
-    }
-    if (access.workspaceDisabled && !isWorkspaceAccessRecoveryRoute(pathname)) {
-        return 'Forbidden: workspace access is not active for this user.';
-    }
-    return null;
+export function sanitizeQaRunIdHeader(raw) {
+    const normalized = String(Array.isArray(raw) ? raw[0] : raw || '')
+        .trim()
+        .replace(/[^A-Za-z0-9._-]+/g, '-');
+    return normalized.slice(0, 128) || '-';
 }
 function shouldLogRefreshDiagnostic(pathname) {
     return REFRESH_DIAGNOSTIC_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(prefix));
@@ -301,31 +297,6 @@ export function resolveCloudProxyUpstreamBaseUrl(req, fallbackBaseUrl) {
         return fallbackBaseUrl;
     return TASKFORCE_CLOUD_ENVIRONMENTS[requestedEnvironment].appBaseUrl;
 }
-export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspaceId) {
-    if (!access.authenticated || !access.userId || access.userId === 'anonymous')
-        return access;
-    const trimmedRequestedWorkspaceId = String(requestedWorkspaceId || '').trim();
-    const candidateWorkspaceIds = [
-        trimmedRequestedWorkspaceId,
-        String(access.workspaceId || '').trim()
-    ].filter((workspaceId, index, values) => Boolean(workspaceId) && values.indexOf(workspaceId) === index);
-    for (const workspaceId of candidateWorkspaceIds) {
-        const resolved = core.resolveUserAccess(access.userId, workspaceId, access.role);
-        if (!resolved)
-            continue;
-        return {
-            ...access,
-            role: resolved.role,
-            workspaceId: resolved.workspaceId,
-            userId: resolved.userId,
-            systemRole: core.getSystemRole(resolved.userId),
-            disabled: resolved.disabled,
-            accountDisabled: resolved.accountDisabled ?? resolved.disabled,
-            workspaceDisabled: resolved.workspaceDisabled ?? false
-        };
-    }
-    return access;
-}
 export function shouldApplyReadOnlyMutationGuard(methodRaw, pathname) {
     const method = String(methodRaw || 'GET').toUpperCase();
     if (method !== 'POST' && method !== 'PATCH' && method !== 'DELETE')
@@ -673,16 +644,33 @@ export function createStandaloneServer(options) {
             },
         } : undefined,
     });
+    const cloudCollectionReadWorkerCount = resolveCloudCollectionReadPoolSize(process.env);
+    const cloudCollectionReadPool = shouldUseCloudCollectionReadPool({
+        runtimeMode,
+        databaseProvider: db.provider,
+        connectionString: db.connectionString,
+        workerCount: cloudCollectionReadWorkerCount,
+    })
+        ? new CloudCollectionReadPool({
+            projectRoot: options.projectRoot,
+            tenantId: core.getTenantId(),
+            connectionString: db.connectionString,
+            size: cloudCollectionReadWorkerCount,
+        })
+        : null;
     const allowedOrigins = getAllowedOriginsFromEnv(process.env.TASKFORCE_ALLOWED_ORIGINS, runtimeMode);
     const rateLimitEnabled = typeof process.env.TASKFORCE_API_RATE_LIMIT_ENABLED === 'string'
         ? process.env.TASKFORCE_API_RATE_LIMIT_ENABLED !== 'false'
         : (runtimeMode === 'cloud');
     const rateLimitLimit = Number.parseInt(process.env.TASKFORCE_API_RATE_LIMIT_MAX_REQUESTS || '', 10) || 120;
     const rateLimitWindowMs = Number.parseInt(process.env.TASKFORCE_API_RATE_LIMIT_WINDOW_MS || '', 10) || 60_000;
+    const syncFeedRateLimit = Number.parseInt(process.env.TASKFORCE_SYNC_FEED_RATE_LIMIT_MAX_REQUESTS || '', 10) || 600;
+    const syncFeedRateLimitWindowMs = Number.parseInt(process.env.TASKFORCE_SYNC_FEED_RATE_LIMIT_WINDOW_MS || '', 10) || 60_000;
     const webhookRateLimitMaxRequests = Number.parseInt(process.env.TASKFORCE_STRIPE_WEBHOOK_RATE_LIMIT_MAX_REQUESTS || '', 10) || 600;
     const webhookRateLimitWindowMs = Number.parseInt(process.env.TASKFORCE_STRIPE_WEBHOOK_RATE_LIMIT_WINDOW_MS || '', 10) || 60_000;
     const maxPayloadBytes = Number.parseInt(process.env.TASKFORCE_MAX_PAYLOAD_BYTES || '', 10) || 1_048_576;
     const rateLimiter = new InMemoryRateLimiter(rateLimitLimit, rateLimitWindowMs);
+    const syncFeedRateLimiter = new InMemoryRateLimiter(syncFeedRateLimit, syncFeedRateLimitWindowMs);
     const webhookRateLimiter = new InMemoryRateLimiter(webhookRateLimitMaxRequests, webhookRateLimitWindowMs);
     const resolveAuthRateLimitSettings = () => {
         const auth = core.getGlobalSettings().auth || {};
@@ -786,7 +774,8 @@ export function createStandaloneServer(options) {
         const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || '-';
         const workspaceId = String(req.headers['x-taskforce-workspace-id'] || '').trim() || '-';
         const userId = String(req.headers['x-taskforce-user-id'] || '').trim() || '-';
-        console.info(`[Taskforce RefreshDiag] method=${method} path=${pathname} status=${statusCode} durationMs=${durationMs} requestId=${requestId} workspaceId=${workspaceId} userId=${userId}`);
+        const qaRunId = sanitizeQaRunIdHeader(req.headers['x-taskforce-qa-run-id']);
+        console.info(`[Taskforce RefreshDiag] method=${method} path=${pathname} status=${statusCode} durationMs=${durationMs} requestId=${requestId} workspaceId=${workspaceId} userId=${userId} qaRunId=${qaRunId}`);
     };
     // Resolve static files directory at runtime
     // Standalone UI source now lives in apps/app and builds to dist/ui.
@@ -1013,7 +1002,9 @@ export function createStandaloneServer(options) {
                     });
                     const rateLimitResult = isBillingWebhook
                         ? webhookRateLimiter.check(key)
-                        : rateLimiter.check(key);
+                        : isWorkspaceSyncFeedRead(req.method, url.pathname)
+                            ? syncFeedRateLimiter.check(key)
+                            : rateLimiter.check(key);
                     if (isBillingWebhook) {
                         applyPrefixedRateLimitHeaders(res, rateLimitResult, 'X-Webhook-RateLimit');
                     }
@@ -1066,6 +1057,39 @@ export function createStandaloneServer(options) {
                     res.end(JSON.stringify({ error: auth.reason || 'Unauthorized' }));
                     return;
                 }
+                const cloudCollectionReadOperation = cloudCollectionReadPool
+                    ? resolveCloudCollectionReadOperation(req.method, url.pathname)
+                    : null;
+                if (cloudCollectionReadPool && cloudCollectionReadOperation) {
+                    try {
+                        const requestedWorkspaceId = Array.isArray(req.headers['x-taskforce-workspace-id'])
+                            ? String(req.headers['x-taskforce-workspace-id'][0] || '')
+                            : String(req.headers['x-taskforce-workspace-id'] || '');
+                        const response = await cloudCollectionReadPool.execute({
+                            operation: cloudCollectionReadOperation,
+                            pathname: url.pathname,
+                            requestedWorkspaceId,
+                            access: accessForRateLimit,
+                            performanceTrace: String(req.headers['x-taskforce-performance-trace'] || '').trim() === '1',
+                        });
+                        if (response.performance) {
+                            logSlowBootstrapRoute({
+                                route: url.pathname,
+                                workspaceId: response.workspaceId,
+                                traceId: String(req.headers['x-taskforce-bootstrap-trace-id'] || '').trim(),
+                                durationMs: response.performance.durationMs,
+                                details: response.performance.details,
+                            });
+                        }
+                        response.headers['X-Taskforce-Cloud-Read-Execution'] = 'worker';
+                        res.writeHead(response.statusCode, response.headers);
+                        res.end(response.body);
+                        return;
+                    }
+                    catch (error) {
+                        console.error(`[Taskforce] Cloud collection read worker failed; using synchronous fallback path=${url.pathname}:`, error instanceof Error ? error.message : String(error));
+                    }
+                }
                 const pathname = url.pathname;
                 const isMutation = shouldApplyReadOnlyMutationGuard(req.method, pathname);
                 let access = accessForRateLimit;
@@ -1203,6 +1227,7 @@ export function createStandaloneServer(options) {
                     if (serverResult.status === 'rejected') {
                         throw serverResult.reason;
                     }
+                    await cloudCollectionReadPool?.close();
                 },
                 closeCore: () => core.close(),
             });

package/dist/server/localServiceLease.d.ts

@@ -1,3 +1,5 @@
+import { type LocalServiceCloudTarget } from '../config/localServiceCloudTarget.js';
+import { type LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
 import { type WindowsAclCommandRunner } from './localServiceWindowsAcl.js';
 export interface LocalServiceDescriptor {
     schemaVersion: 1;
@@ -9,6 +11,8 @@ export interface LocalServiceDescriptor {
     generation: string;
     bootstrapCapability: string;
     publishedAt: string;
+    cloudTarget?: LocalServiceCloudTarget | null;
+    runtimeContract?: LocalServiceRuntimeContract | null;
 }
 export interface LocalServiceLeaseIdentityInput {
     projectRoot: string;
@@ -27,6 +31,8 @@ export interface LocalServiceDescriptorPublication {
     endpoint: string;
     protocolVersion: string;
     appVersion: string;
+    cloudTarget: LocalServiceCloudTarget;
+    runtimeContract: LocalServiceRuntimeContract;
 }
 export interface LocalServiceLease {
     readonly identity: LocalServiceLeaseIdentity;

package/dist/server/localServiceLease.js

@@ -3,6 +3,8 @@ import * as fs from 'fs';
 import * as net from 'net';
 import * as os from 'os';
 import * as path from 'path';
+import { parseLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
+import { parseLocalServiceRuntimeContract, } from '../config/localServiceRuntimeContract.js';
 import { resolveLocalSyncProcessLockIdentity } from './localDatabaseIdentity.js';
 import { ensureWindowsUserOnlyDirectoryAcl, } from './localServiceWindowsAcl.js';
 const DESCRIPTOR_SCHEMA_VERSION = 1;
@@ -161,8 +163,20 @@ function parseDescriptor(value, ownershipKey) {
         || typeof value.publishedAt !== 'string') {
         throw new Error('Local service descriptor is invalid.');
     }
+    const cloudTarget = value.cloudTarget == null
+        ? null
+        : parseLocalServiceCloudTarget(value.cloudTarget);
+    if (value.cloudTarget != null && !cloudTarget) {
+        throw new Error('Local service descriptor cloud target is invalid.');
+    }
+    const runtimeContract = value.runtimeContract == null
+        ? null
+        : parseLocalServiceRuntimeContract(value.runtimeContract);
+    if (value.runtimeContract != null && !runtimeContract) {
+        throw new Error('Local service descriptor runtime contract is invalid.');
+    }
     assertLoopbackEndpoint(value.endpoint);
-    return value;
+    return { ...value, cloudTarget, runtimeContract };
 }
 function readOptionalDescriptor(identity) {
     try {
@@ -363,6 +377,8 @@ export async function acquireLocalServiceLease(input, dependencies = {}) {
                         generation,
                         bootstrapCapability,
                         publishedAt: (dependencies.now?.() || new Date()).toISOString(),
+                        cloudTarget: publication.cloudTarget,
+                        runtimeContract: publication.runtimeContract,
                     };
                     publishJsonFileAtomically(identity.descriptorPath, descriptor, platform);
                     return descriptor;

package/dist/server/localWorkspaceSyncServerRuntime.js

@@ -15,6 +15,7 @@ import { createWorkspaceSyncEngineServerRunnerOperations } from '../sync/engine/
 import { workspaceSyncTransferEvidenceEvent } from '../sync/engine/workspaceSyncTransferEvidence.js';
 import { createWorkspaceSyncEngineServerPushCandidateProvider, createWorkspaceSyncEngineServerSnapshotReader, } from '../sync/engine/workspaceSyncEngineServerSnapshotReader.js';
 import { readWorkspaceSyncLocalOwnershipSnapshot } from '../sync/v3/workspaceSyncLocalOwnershipSnapshot.js';
+import { resolveRequestedCombinedFeedCoverage } from '../sync/v3/combinedFeedCapability.js';
 import { resolveWorkspaceSyncV3CombinedWireContract, } from '../sync/v3/workspaceSyncV3CombinedWireContract.js';
 import { LocalWorkspaceSyncServerOutboxDispatcher, } from '../sync/v3/localWorkspaceSyncServerOutboxDispatcher.js';
 import { readWorkspaceSyncV3LocalOutboxStatus, } from '../sync/v3/workspaceSyncV3LocalOutboxStatus.js';
@@ -950,15 +951,21 @@ export class LocalWorkspaceSyncServerRuntime {
                 if (combined.owner === 'v3' && !combinedContract) {
                     throw Object.assign(new Error('The persisted combined-feed ownership contract is invalid.'), { code: 'SYNC_RUNNER_V3_OWNERSHIP_INVALID' });
                 }
+                const desiredCombinedCoverage = combined.owner === 'v3'
+                    ? resolveRequestedCombinedFeedCoverage(this.options.env || process.env)
+                    : null;
+                const desiredCombinedContract = desiredCombinedCoverage
+                    ? resolveWorkspaceSyncV3CombinedWireContract(desiredCombinedCoverage)
+                    : null;
                 return {
                     initiativeFeedActivationEnabled: ownership.initiativeProjection.owner === 'v3',
                     initiativeProjection: ownership.initiativeProjection,
                     combinedFeedActivationEnabled: combined.owner === 'v3',
                     combinedProjection: combined,
-                    ...(combinedContract
+                    ...(combinedContract && desiredCombinedContract
                         ? {
-                            combinedFeedCoverage: combinedContract.coverage,
-                            combinedFeedExcludedProjections: combinedContract.excludedProjections,
+                            combinedFeedCoverage: desiredCombinedContract.coverage,
+                            combinedFeedExcludedProjections: desiredCombinedContract.excludedProjections,
                         }
                         : {}),
                 };

package/dist/server/rateLimit.d.ts

@@ -26,5 +26,6 @@ export declare function resolveRateLimitKey(params: {
     sessionId?: string | null;
     userId?: string | null;
 }): string;
+export declare function isWorkspaceSyncFeedRead(method: string | undefined, pathname: string): boolean;
 export declare function applyRateLimitHeaders(res: ServerResponse, result: RateLimitResult): void;
 export declare function applyPrefixedRateLimitHeaders(res: ServerResponse, result: RateLimitResult, prefix: string): void;

package/dist/server/rateLimit.js

@@ -97,6 +97,10 @@ export function resolveRateLimitKey(params) {
     }
     return `ip:${ip}:${method}:${route}`;
 }
+export function isWorkspaceSyncFeedRead(method, pathname) {
+    return String(method || 'GET').trim().toUpperCase() === 'GET'
+        && pathname === '/api/taskforce/sync/v3/workspace/feed';
+}
 export function applyRateLimitHeaders(res, result) {
     res.setHeader('X-RateLimit-Limit', String(result.limit));
     res.setHeader('X-RateLimit-Remaining', String(result.remaining));

package/dist/server/realtimeSyncWs.js

@@ -68,23 +68,34 @@ export function createRealtimeSyncWsManager(core, authConfig, logger = console,
         }
         connections.delete(ws);
     };
-    const canSubscribe = (state, workspaceId) => {
+    const resolveSubscriptionAccess = (state, workspaceId) => {
         if (!workspaceId)
-            return false;
+            return 'forbidden';
         if (!authConfig.enabled || !authConfig.requiredForApi)
-            return true;
+            return 'allowed';
         if (!state.authenticated || !state.userId || state.userId === 'anonymous')
-            return false;
-        const resolved = core.resolveUserAccess(state.userId, workspaceId, state.role);
-        return Boolean(resolved?.workspaceId === workspaceId);
+            return 'forbidden';
+        try {
+            const resolved = core.resolveUserAccess(state.userId, workspaceId, state.role);
+            return resolved?.workspaceId === workspaceId ? 'allowed' : 'forbidden';
+        }
+        catch (error) {
+            logger.warn(`[Taskforce] WebSocket access check unavailable workspace=${workspaceId}: ${String(error instanceof Error ? error.message : error)}`);
+            return 'unavailable';
+        }
     };
     const closeUnauthorized = (ws, reason) => {
         logger.warn(`[Taskforce] WebSocket rejected: ${reason}`);
         ws.close(1008, reason);
     };
     const subscribeWorkspace = (ws, state, workspaceId) => {
-        if (!canSubscribe(state, workspaceId)) {
-            send(ws, { type: 'taskforce:subscription-error', workspaceId, reason: 'forbidden' });
+        const accessDecision = resolveSubscriptionAccess(state, workspaceId);
+        if (accessDecision !== 'allowed') {
+            send(ws, {
+                type: 'taskforce:subscription-error',
+                workspaceId,
+                reason: accessDecision === 'unavailable' ? 'temporarily-unavailable' : 'forbidden'
+            });
             return;
         }
         state.workspaceIds.add(workspaceId);
@@ -132,8 +143,13 @@ export function createRealtimeSyncWsManager(core, authConfig, logger = console,
             send(ws, { type: 'taskforce:replay-error', reason: 'workspace-required' });
             return;
         }
-        if (!canSubscribe(state, workspaceId)) {
-            send(ws, { type: 'taskforce:replay-error', workspaceId, reason: 'forbidden' });
+        const accessDecision = resolveSubscriptionAccess(state, workspaceId);
+        if (accessDecision !== 'allowed') {
+            send(ws, {
+                type: 'taskforce:replay-error',
+                workspaceId,
+                reason: accessDecision === 'unavailable' ? 'temporarily-unavailable' : 'forbidden'
+            });
             return;
         }
         state.workspaceIds.add(workspaceId);
@@ -191,8 +207,16 @@ export function createRealtimeSyncWsManager(core, authConfig, logger = console,
         connections.set(ws, state);
         logger.log(`[Taskforce] WebSocket client connected user=${state.userId}`);
         const initialWorkspaceId = parseWorkspaceId(access.workspaceId);
-        if (initialWorkspaceId && canSubscribe(state, initialWorkspaceId)) {
-            state.workspaceIds.add(initialWorkspaceId);
+        if (initialWorkspaceId) {
+            const accessDecision = resolveSubscriptionAccess(state, initialWorkspaceId);
+            if (accessDecision === 'unavailable') {
+                ws.close(1013, 'access-unavailable');
+                removeConnection(ws);
+                return;
+            }
+            if (accessDecision === 'allowed') {
+                state.workspaceIds.add(initialWorkspaceId);
+            }
         }
         ws.on('message', (rawData) => {
             const payload = parseJson(rawData);

package/dist/server/routes/admin.js

@@ -1953,6 +1953,7 @@ export function registerAdminRoutes(deps) {
             workspaceAssetStore,
             publishedContentResolver,
             repairMissingAssetLinks: true,
+            repairMissingContentFiles: body?.repairMissingContentFiles === true,
             aiProfiles: typeof core.listAiProfiles === 'function'
                 ? core.listAiProfiles(workspaceId, { includeArchived: true }) || []
                 : [],

package/dist/server/routes/agentRoles.js

@@ -1,4 +1,5 @@
-import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
+import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, } from '../../runtime/appGates.js';
+import { resolveNodeAppGateAccess } from '../../runtime/nodeAppGates.js';
 import { AgentRoleDefinitionValidationError } from '../../shared/agentRoleDefinition.js';
 import { AgentRoleConflictError, AgentRoleNotFoundError, AgentRoleRetiredError, AgentRoleStore, } from '../../storage/agentRoleStore.js';
 import { parseJsonBody } from './primitives.js';
@@ -128,7 +129,7 @@ export function registerAgentRolesRoutes(deps) {
     const guard = (req, res) => {
         if (!ensureAppAccess(req, res))
             return false;
-        const gate = resolveAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
+        const gate = resolveNodeAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
         if (gate.allowed)
             return true;
         writeJson(res, 403, {

package/dist/server/routes/agentSkills.js

@@ -1,4 +1,5 @@
-import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
+import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, } from '../../runtime/appGates.js';
+import { resolveNodeAppGateAccess } from '../../runtime/nodeAppGates.js';
 import { compileTaskforceAgentSkillPrompt } from '../../shared/taskforceAgentSkill.js';
 import { TaskforceAgentStore } from '../../storage/taskforceAgentStore.js';
 import { TaskforceAgentSkillConflictError, TaskforceAgentSkillStore, } from '../../storage/taskforceAgentSkillStore.js';
@@ -73,7 +74,7 @@ export function registerAgentSkillsRoutes(deps) {
     const ensureFeatureAccess = (req, res) => {
         if (!ensureAppAccess(req, res))
             return false;
-        const gate = resolveAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
+        const gate = resolveNodeAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
         if (gate.allowed)
             return true;
         writeJson(res, 403, {